Field of the Invention
The present invention relates to the determination of access to resources on a remote server computer over a network. Various aspect of the invention may be used to limit access to resources on a remote computer based upon a user's computing environment.
Description of the Related Art
In the last decade, the use of electronic computer networks has greatly increased. Electronic computer networks may be found in businesses, schools, hospitals, and even residences. With these networks, two or more computing devices communicate together to exchange packets of data according to one or more standard protocols, such as the TCP/IP protocols. Usually, one computer, often referred to as a “client,” requests that a second computer perform a service. In response, the second computer, often referred to as a “server,” performs the service and communicates the resulting data back to the first computer.
As reliance on computers has increased, the demand to access computer resources from a variety of locations has increased as well. Conventionally, for example, a business user may have accessed resources on a corporate server through a desktop computer connected to the corporate server by a private, secure corporate network. Now, however, that user may wish to access the same corporate resources from a personal computer at home over a public network, such as the Internet. Still further, the user may wish to access those resources from a laptop computer while traveling. The connection to the corporate server computer might then be made over a publicly accessible wireless network connection in a hotel or coffee shop. In some instances, that user may even desire to access those corporate resources from a computer at a public kiosk.
In addition to accessing a resource on a remote computer from a variety of computing environments, the user may also employ a number of different communication and security techniques when accessing those resources. For example, a laptop provided by the same company maintaining the desired resources may have dedicated communication software installed. It may also have sophisticated security-related software, such as commercial anti-malware and anti-virus software. The same user's home computer, however, may only have some limited security-related software, such as residential anti-virus software. Also, it may communicate with the remote server computer using a browser application with additional “plug-in” software to enhance the browser's communication abilities. Still further, a computer at a public kiosk may have little or no security-related software, and provide only a basic browser software application for communicating with the remote server. Still further, a computer may access remote resources via communication channels secured using the Secure Socket Layers (SSL) protocol, the Hypertext Transfer Protocol Secure (HTTPS) protocol (which employs the Secure Socket Layers (SSL) protocol, or the Internet Protocol Security (IPSec) protocol on another computer.
Despite this wide variety of computing environments and associated variety of security risks now being used to access resources on remote computers, actual access to resources typically is predicated only on the user's identification. This identification may be direct, such as by credential information personally associated with the user, or indirect, such as credential information associated with a particular computer or copy of a software application. Thus, if a user can provide the proper credentials to authenticate his or her identity, the user can access authorized resources regardless of the type of resource being accessed or the security of the computing environment being used to access the resources.